[asterisk-ss7] ss7 reset crashes with chan_0.9

[Markus Monka]

Hi,

asterisk crashes with cli command "ss7 reset"

asterisk:  1.2.12.1
zaptel: 1.2.9.1
libpri: 1.2.3

shell I update to a newer Asterisk Version?

#0  0x400267f1 in pthread_mutex_lock () from /lib/tls/libpthread.so.0
#1  0x40564c6c in ast_mutex_lock (pmutex=0x24) at lock.h:601
#2  0x405633ef in cmd_reset (fd=1, argc=2, argv=0xbffff950) at chan_ss7.c:4246
#3  0x080921ae in ast_cli_command (fd=1, s=0x24 <Address 0x24 out of bounds>) at cli.c:1364
#4  0x080b5cb8 in main (argc=135513432, argv=0xbffffdd4) at asterisk.c:1008


#0  0x400267f1 in pthread_mutex_lock () from /lib/tls/libpthread.so.0
No symbol table info available.
#1  0x40564c6c in ast_mutex_lock (pmutex=0x24) at lock.h:601
No locals.
#2  0x405633ef in cmd_reset (fd=1, argc=2, argv=0xbffff950) at chan_ss7.c:4246
        pvt = (struct ss7_chan *) 0x0
        linkset = (struct linkset *) 0x4057e500
        i = 16
        lsi = 0
        idle_list = (struct ss7_chan *) 0x814db88
#3  0x080921ae in ast_cli_command (fd=1, s=0x24 <Address 0x24 out of bounds>) at cli.c:1364
        argv = {0x814db88 "ss7", 0x814db8c "reset", 0x0, 0x814db80 "rior\031", 0x40206900 "", 0x40206948 "", 0x40206900 "", 
  0x4014005e "\211Ç\017·FDf\205Àt\004\205ÿu3\213N\\\213F\034\205É\211F\f\211F\004\211F\b\211F\024\211F\020~\020\213F \211F\030\203Ä\020\211ø[^_]Ã÷\006\002\002", 0x814c2b8 "\fg\001@\031", 0x3 <Address 0x3 out of bounds>, 
  0x10 <Address 0x10 out of bounds>, 0x40206900 "", 0x40205f40 "H\036\023", 0x40206900 "", 0x1 <Address 0x1 out of bounds>, 0xbffff9a8 "H", 0x40145c43 "\205À\211Çt\031e\203=\f", 0x40206900 "", 0x40146e24 "\201Ã\034ñ\v", 
  0x40205f40 "H\036\023", 0xb <Address 0xb out of bounds>, 0x813aec8 "ss7 reset ", 0x48 <Address 0x48 out of bounds>, 
  0x4014c0a6 "\211Â\213]ô\211Ð\213uø\213}ü\211ì]Ã\220\220\220\220\220\220\220\220\220U\211å\203ì\030\211}ü\213U\f\213}\b\211]ô\211uøèÃÖùÿ\201Ãf\236\v", 0x814c2c0 "ss7 reset ", 0x813aec8 "ss7 reset ", 
  0xb <Address 0xb out of bounds>, 0x40206900 "", 0x40205f40 "H\036\023", 0x40206900 "", 0x813ab60 "p«\023\bx«\023\b\210Å\023\b\220«\023\b\220ž\r\b\031", 0xbffff9e8 "\búÿ¿¹ö\r\b`«\023\bšúÿ¿È®\023\b", 
  0x40145dcb "e\203=\f", 0x40206900 "", 0x813ab60 "p«\023\bx«\023\b\210Å\023\b\220«\023\b\220ž\r\b\031", 0x813ab60 "p«\023\bx«\023\b\210Å\023\b\220«\023\b\220ž\r\b\031", 0x813c588 "", 0xbffffabc "\v", 
  0xbffffa08 "húÿ¿5ì\r\b\210Å\023\bšúÿ¿È®\023\bÀî\037@", 0x80df6b9 "\213F\030H;F\024\211F\030~\004\205À\177Ç1Ò\203Ä\020\211Ð[^]ÃèÿW÷ÿ\215Ž&", 0x813ab60 "p«\023\bx«\023\b\210Å\023\b\220«\023\b\220ž\r\b\031", 
  0xbffffaa8 "h", 0x813aec8 "ss7 reset ", 
  0x40018000 "\033[0;37;40mffer to zaptel len=16, on link 'l1'.\n]: \033[1;37;40mmtp.c\033[0;37;40m:\033[1;37;40m1374\033[0;37;40m \033[1;37;40mmtp2_fill_zaptel_buf\033[0;37;40m: ;37;40m: ne.so     chan_sip.so       chan_skinny.so    ch"..., 0xbffffaa8 "h", 0x813c558 "\210Å\023\bh", 0xbffffa68 "Hýÿ¿ž\\\v\b\001", 
  0x80dec35 "\203øÿ\211Â\017\204\222þÿÿ\213;\211~\004é\210þÿÿ\213:\213V\004\211\\$\004\211T$\b\213\016\211\f$ÿV\034\203øÿ\211Âušégþÿÿ\201~\fÐô\r\bt\a1ÒéWþÿÿ\2136\213^\f9ót:\215¶", 0x813c588 "", 0xbffffaa8 "h", 
  0x813aec8 "ss7 reset ", 0x401feec0 "\204*­û", 
  0x40018000 "\033[0;37;40mffer to zaptel len=16, on link 'l1'.\n]: \033[1;37;40mmtp.c\033[0;37;40m:\033[1;37;40m1374\033[0;37;40m \033[1;37;40mmtp2_fill_zaptel_buf\033[0;37;40m: ;37;40m: ne.so     chan_sip.so       chan_skinny.so    ch"..., 0xa <Address 0xa out of bounds>, 0x401feec0 "\204*­û", 0xbffffa50 "húÿ¿(L\023@Àî\037@È®\023\bXÅ\023\bŒúÿ¿Hýÿ¿ž\\\v\b\001", 0x401406a2 "é^ÿÿÿ\211ö\215Œ'", 0x401feec0 "\204*­û", 
  0x40018000 "\033[0;37;40mffer to zaptel len=16, on link 'l1'.\n]: \033[1;37;40mmtp.c\033[0;37;40m:\033[1;37;40m1374\033[0;37;40m \033[1;37;40mmtp2_fill_zaptel_buf\033[0;37;40m: ;37;40m: ne.so     chan_sip.so       chan_skinny.so    ch"..., 0xa <Address 0xa out of bounds>, 0x812e760 "Hå\022\bÀî\037@ ð\037@", 0x40205f40 "H\036\023", 0x401feec0 "\204*­û", 0x401feb80 ""}
        e = (struct ast_cli_entry *) 0x73aa
        x = 2
        dup = 0x814db88 "ss7"
        tws = 1
#4  0x080b5cb8 in main (argc=135513432, argv=0xbffffdd4) at asterisk.c:1008
        title = "Asterisk Console on 'gw01' (pid 29610)\000\001", '\0' <repeats 20 times>, "\001", '\0' <repeats 15 times>, "\030Ì\r at tûÿ¿<{\000\000\000\a\000\000\210¿\r@\204ûÿ¿<{\000@ÔP\016@ÔP\016@\200Q\016@Í5\002\000\000\000\000\000 \000\000\000<{\000@ÔP\016@Š7\005\b\226Q\016 at 8ÿ\r at 8t\r\000Ø\037\002@Àûÿ¿<{\000 at g5\002@Š7\005\b\234û\002@;+\016@Œî\004\b \000\000\000;+\016@£ëV\001\210¿\r@è5\002@\030%\002@ø\017\002@à|\001"...
        c = 36
        filename = "/root/.asterisk_history", '\0' <repeats 56 times>
        hostname = "gw01", '\0' <repeats 59 times>
        tmp = "\033[1;37;40mAsterisk Ready.\n\033[0;37;40m\000\000\000\000 \000\000\000\000i @@_ @\000i @\001\000\000\000žüÿ¿\224c\024@\000i @\033\000\000\000äg\002@"
        xarg = 0x0
        x = 36
        f = (FILE *) 0x813aec8
        sigs = {__val = {134238211, 0 <repeats 31 times>}}
        num = 11
        is_child_of_nonroot = 0
        buf = 0x813aec8 "ss7 reset "
        runuser = 0xbffffabc "\v"
        rungroup = 0x0


Best Regards
Markus